CVE-2025-39872

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39872
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39872.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-39872
Downstream
Published
2025-09-23T06:00:45Z
Modified
2026-08-12T03:51:16Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
hsr: hold rcu and dev lock for hsr_get_port_ndev
Details

In the Linux kernel, the following vulnerability has been resolved:

hsr: hold rcu and dev lock for hsr_get_port_ndev

hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39872.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ef964411c8ca775967355d855abc56aeaca3c867
Fixed
9433ba79c2ec3ec7c9a711748701549339c3438c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9c10dd8eed74de9e8adeb820939f8745cd566d4a
Fixed
68a6729afd3e8e9a2a32538642ce92b96ccf9b1d
Fixed
847748fc66d08a89135a74e29362a66ba4e3ab15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.63
Fixed
6.12.64

Affected versions

v6.*
v6.12.63

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39872.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.64
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.16.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39872.json"